GCVE-110-OSM-2026-9561

The package self-identifies as a 'security research - dependency confusion test' with the author email rootxravi@bugcrowdninja.com, a BugCrowd ninja domain strongly indicating a legitimate bug bounty researcher. Despite this, the code is a fully functional OAST-based dependency confusion probe: on install it collects hostname, username, CI environment variables, cloud credentials (AWS/GCP/Azure), secret-named env vars, and exfiltrates via four redundant channels (DNS hex-encoded chunks via nslookup, HTTPS POST, HTTP POST fallback, and dns.resolve) to qtmetsrtvaujwklywbgw2wihc2lebzu0n.oast.fun. The attacker model is classic supply-chain reconnaissance — but the declared purpose and bugcrowdninja.com affiliation suggest this is an authorized security test rather than a genuine attack. Per adjudication rules, self-identified bounty test packages should be treated as suspicious-but-benign to avoid OSM database pollution. ENTRY index.js (install-hook: node index.js || true) - Install Hook Executes Local JS File in package.json - Postinstall Script in package.json DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in index.js: ".oast.fun" - Network Request in index.js: "https.request(" - System Information Collection in index.js: "os.userInfo()" - DNS Lookup in index.js: "dns.resolve(" - Suspicious Domain in index.js: "oast.fun" ADDITIONAL FINDINGS - Shell Command Execution in index.js: "require("child_process")" - Brand New Package PAYLOAD FILES index.js